# Source: PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

tech-noisy: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲

**tech-noisy** · [https://tech-noisy.com/2026/10/22/php2shell-php-rce-cve-2026-109618/](https://tech-noisy.com/2026/10/22/php2shell-php-rce-cve-2026-109618/) · published 2026-10-22T01:34:38+00:00 · added by `curator@php.newsroom` · slug `tech-noisy-2026-10-22-php2shell-php-rce-cve-2026-10`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). tech-noisy (Japanese), 22 October: an explainer headed 'PHP2Shell: two flaws in PHP itself and fixed versions 8.5.12'. It says PHP published fixes on...

## What it says, as the collector read it

#### PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `jp/news/tech-noisy/2026-10-22-php2shell-php-rce-cve-2026-109618`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

tech-noisy (Japanese), 22 October: an explainer headed 'PHP2Shell: two flaws in PHP itself and fixed versions 8.5.12'. It says PHP published fixes on 21 October (CVSS 4.0 9.2), the official advisory names PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed and rates mod_php highest, 8.2 to 8.5 need updating and 8.1 and earlier get no official fix, and that Wiz, which found it, says it used Gemini 4 Argon and GPT-5.6 Sol. It says PHP had pre-announced on the 20th that it might publish earlier if details became public or real exploitation was seen, that the CVE numbers were reported to have leaked online the day before, and that, although some reports say real attacks had started, Huntress said at the evening of 21 October (US Eastern) that it had not seen exploitation in its monitored environments. It carries an editorial view and an FAQ.

> 実際の攻撃が出始めたとの報告もある一方、Huntress は 21 日夕方(米東部時間)の時点で、自社の監視先では悪用を確認していないとしています。

_Curator's translation:_ "While there are reports that real attacks have begun, Huntress says that as of the evening of the 21st (US Eastern time) it had not confirmed exploitation in the environments it monitors."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ tech-noisy.com (Japan) explainer of the advisory and Wiz research. It adds Google Cloud guidance (rebuild GKE/Cloud Run images, Cloud Armor managed rules protect, App Engine standard PHP 8.2+ auto-patched) and Huntress saying it had seen no exploitation as of 21 Oct evening (US Eastern).

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell - PHP本体の脆弱性2件と修正版8.5.12・影響範囲". Selected mechanically, not read by a person.

#### Capture notes

Language `ja`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://tech-noisy.com/2026/10/22/php2shell-php-rce-cve-2026-109618/- `headers.json` 8b127169b90556b903f5390312a835ab5e9995a881b341d7808038de6fd0bdbc 565 bytes
- `page.html` e9688d38fe817a9be886bd61660a625b69892f54818074df6f4b93182a3155b9 297,452 bytes
- `provenance.json` 6e65ff25b3fda2d3b1135c9a24f4e67c5d2ae40d1dd7612bb01b5ee5f351348b 1,546 bytes
- `text.txt` 5f8a25c11cb647793db8c9c71ba37be748b0ed9384d0ee3f71e584c4bbfee168 16,360 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/tech-noisy-2026-10-22-php2shell-php-rce-cve-2026-10/index.html